1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
From: Jan Beulich <jbeulich@suse.com>
Subject: gnttab/ARM: don't corrupt shared GFN array
... by writing status GFNs to it. Introduce a second array instead.
Also implement gnttab_status_gmfn() properly now that the information is
suitably being tracked.
While touching it anyway, remove a misguided (but luckily benign) upper
bound check from gnttab_shared_gmfn(): We should never access beyond the
bounds of that array.
This is part of XSA-255.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
--- a/xen/arch/arm/domain.c
+++ b/xen/arch/arm/domain.c
@@ -428,19 +428,37 @@ void startup_cpu_idle_loop(void)
struct domain *alloc_domain_struct(void)
{
struct domain *d;
+ unsigned int i, max_status_frames;
+
BUILD_BUG_ON(sizeof(*d) > PAGE_SIZE);
d = alloc_xenheap_pages(0, 0);
if ( d == NULL )
return NULL;
clear_page(d);
- d->arch.grant_table_gpfn = xzalloc_array(xen_pfn_t, max_grant_frames);
+
+ d->arch.grant_shared_gfn = xmalloc_array(gfn_t, max_grant_frames);
+ max_status_frames = grant_to_status_frames(max_grant_frames);
+ d->arch.grant_status_gfn = xmalloc_array(gfn_t, max_status_frames);
+ if ( !d->arch.grant_shared_gfn || !d->arch.grant_status_gfn )
+ {
+ free_domain_struct(d);
+ return NULL;
+ }
+
+ for ( i = 0; i < max_grant_frames; ++i )
+ d->arch.grant_shared_gfn[i] = _gfn(INVALID_GFN);
+
+ for ( i = 0; i < max_status_frames; ++i )
+ d->arch.grant_status_gfn[i] = _gfn(INVALID_GFN);
+
return d;
}
void free_domain_struct(struct domain *d)
{
- xfree(d->arch.grant_table_gpfn);
+ xfree(d->arch.grant_shared_gfn);
+ xfree(d->arch.grant_status_gfn);
free_xenheap_page(d);
}
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -1057,6 +1057,7 @@ int xenmem_add_to_physmap_one(
int rc;
p2m_type_t t;
struct page_info *page = NULL;
+ bool_t status = 0;
switch ( space )
{
@@ -1074,6 +1075,7 @@ int xenmem_add_to_physmap_one(
mfn = virt_to_mfn(d->grant_table->status[idx]);
else
mfn = INVALID_MFN;
+ status = 1;
}
else
{
@@ -1089,7 +1091,10 @@ int xenmem_add_to_physmap_one(
if ( mfn != INVALID_MFN )
{
- d->arch.grant_table_gpfn[idx] = gpfn;
+ if ( status )
+ d->arch.grant_status_gfn[idx] = _gfn(gpfn);
+ else
+ d->arch.grant_shared_gfn[idx] = _gfn(gpfn);
t = p2m_ram_rw;
}
--- a/xen/include/asm-arm/domain.h
+++ b/xen/include/asm-arm/domain.h
@@ -52,7 +52,8 @@ struct arch_domain
uint64_t vttbr;
struct hvm_domain hvm_domain;
- xen_pfn_t *grant_table_gpfn;
+ gfn_t *grant_shared_gfn;
+ gfn_t *grant_status_gfn;
struct io_handler io_handlers;
/* Continuable domain_relinquish_resources(). */
--- a/xen/include/asm-arm/grant_table.h
+++ b/xen/include/asm-arm/grant_table.h
@@ -14,7 +14,6 @@ int replace_grant_host_mapping(unsigned
unsigned long new_gpaddr, unsigned int flags);
void gnttab_mark_dirty(struct domain *d, unsigned long l);
#define gnttab_create_status_page(d, t, i) do {} while (0)
-#define gnttab_status_gmfn(d, t, i) (0)
#define gnttab_release_host_mappings(domain) 1
static inline int replace_grant_supported(void)
{
@@ -29,8 +28,12 @@ static inline int replace_grant_supporte
} while ( 0 )
#define gnttab_shared_gmfn(d, t, i) \
- ( ((i >= nr_grant_frames(d->grant_table)) && \
- (i < max_grant_frames)) ? 0 : (d->arch.grant_table_gpfn[i]))
+ gfn_x(((i) >= nr_grant_frames(t)) ? _gfn(INVALID_GFN) \
+ : (d)->arch.grant_shared_gfn[i])
+
+#define gnttab_status_gmfn(d, t, i) \
+ gfn_x(((i) >= nr_status_frames(t)) ? _gfn(INVALID_GFN) \
+ : (d)->arch.grant_status_gfn[i])
#define gnttab_need_iommu_mapping(d) \
(is_domain_direct_mapped(d) && need_iommu(d))
|
